Sensitive Data Exposure via Unencrypted HTTP in VX800v v1.0 Web Interface

Publication date: 2026-01-29

Last updated on: 2026-03-09

Assigner: TPLink

Description

Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network adjacent attacker to intercept this traffic and compromise its confidentiality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-29

Last Modified

2026-03-09

Generated

2026-07-06

AI Q&A

2026-01-29

EPSS Evaluated

2026-07-05

NVD

CVE-2025-15548

EUVD

EUVD-2025-206535

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	vx800v_firmware	to 800.0.18 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-311	The product does not encrypt sensitive or critical information before storage or transmission.

Attack-Flow Graph

Executive Summary

This vulnerability involves some VX800v v1.0 web interface endpoints transmitting sensitive information over unencrypted HTTP because they lack application layer encryption. This allows an attacker who is adjacent on the network to intercept the traffic and compromise the confidentiality of the sensitive data.

Impact Analysis

The vulnerability can lead to the interception and compromise of sensitive information transmitted by the VX800v v1.0 web interface. An attacker on the same or nearby network can eavesdrop on this unencrypted traffic, potentially gaining access to confidential data.

Hi! I’m here to help you understand CVE-2025-15548. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70